Access to other devices on mgmt VLAN through fortigates

[damianhlozano]

Hello team!!!

We have 2 Fortigates 100F in HA, we have connected the management VLAN (VLAN 30) on "Mgmt" interface on both Fortigates (VLAN 30 is untagged on ports where Mgmt interfaces are connected) and configured HA to use Mgmt interface as "Out of band", with dedicated IP for both Fortigates (A boss wanted to configure this as out of band)

Now, we have many other devices on the management VLAN.

We cannot access to any device on the management VLAN, from a computer in another VLAN, but we need to this to be possible.  Also, we need to access Fortigates from another VLAN.

I think I can add routes in FGTs, because the mgmt network segment is not on the routing table, but this seems dirty to me.  It sounds like "out of band" doesn't make sense in that case.

I think I can add VMs in the management VLAN for this purpose, but I am adding steps to access to Fortigates and switches

Which is the common scenario for management VLAN?

All people who needs to access any device in the Management VLAN should be in this VLAN?

Other devices as switches, aps, etc, should be in different VLAN? 

Thanks in advance.

Regards,

Damián

[Kangming]

You know this is called HA Reserved Management Interface(mgmt1), so you can't use it as a routing forwarding interface, like a normal business interface, which is contradictory.

Configure an IP address in the same network segment on the business interface(port10). This interface is used to handle management traffic business. It is not a management port but a interface for control(policy) mgmt traffic to the management network segment.

This idea is very clear, and this is also a general solution.

[Toshi_Esumi]

You're asking about YOUR network, especially network device management network, design in general, including FGTs, switches, routers, servers and other devices. Not only the FGTs.

There is no such thing as "FGT standard" network management scheme. FTNT provides various ways to manage FGTs. And majority of FGT users don't even have their FGTs in HA. Like a signle home 40F users. So it's completely up to each user, like your company, to decide how to build management network scheme, or no management network at all.

For example, we as a networking company, use both inband management (for regular configuration task in HA situations where you don't have to know which device is primary.) for FGTs and outband management (dedicated-to management "mgmt" interface for specific maintenance tasks especially when HA got broken and need to fix it). But we have "jumpboxes" in the restricted management network or SSL VPN (with a realm) into the network and built accessibility to all devices only from the mgmt network, not only for all our FGTs but also any other networking devices we deploy.

And again, this is not everybody's scenario and most of individual FGT owners are using one of LAN interfaces with 192.168.1.99 to access it to manage. And, it's not about which interface/mgmt interface to use but more about how to build restrictions/segmentation for admin user's access.

Toshi

[damianhlozano]

Thanks Toshi for your response!

I think no one is understanding to me, maybe my explanation was wrong.

When you have "Out of band" how do you do to access another devices in the management network through Fortigates?

Regards,

Damián

[Toshi_Esumi]

To let everybody understand, you need to provide a network diagram how you built your management network and what paths you're specifically talking about to access from where to where.

Toshi